The crash happens because the cancelling of the file browser removes its screen (as in bScreen). Before rBb75ce05c3b0f, the file browser event wouldn't be handled any further then. After it, it would still be passed to other areas, while the screen pointer was dangling.
All this is very fragile code that has caused many bugs already. It's another example where we would need some kind of "sandboxed" execution for destructive handlers. See D7795.

@Jacques Lucke (JacquesLucke) I think going back to your earlier approach in D7720 is the best solution. It fixes this crash, and also still fixes T75292 & T73579. Would've prefered the more general solution, but the one specific to UI-handlers is still totally acceptable.